Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 18:17
General
- Target 2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
- Size 3.9MB
- Sample260802-ww87dsdr61
- SHA256 ec21f5aa188122f0d4a11bcb5af442f4cee622a7e58e64c24f4640e1a92151c4
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\34123.exe"C:\Users\Admin\AppData\Local\Temp\34123.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
appvcleaner.exe
34123.exe
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
memory/1196-9-0x00007FF79BEA3000-0x00007FF79BEA4000-memory.dmp
memory/1964-225-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-234-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-235-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-236-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-237-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-238-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-239-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-240-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-241-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-242-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-243-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-244-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-245-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1964-246-0x0000000000400000-0x000000000040F000-memory.dmp